Over the weekend, the Instagram accounts of the Obama White House and the Chief Master Sergeant of the U.S. Space Force briefly displayed pro-Iranian images and messages. The defacements were embarrassing for Meta, but the method behind them was more troubling. The hackers did not break through a firewall or steal passwords. They talked an artificial-intelligence chatbot into handing over the accounts, according to security researchers who documented the attacks.
Instructions began circulating on Telegram on May 31 showing how to trick Meta’s AI customer support assistant into resetting an account’s password, according to a detailed account from Krebs on Security. The technique, demonstrated in a video posted by pro-Iran hackers, was deceptively simple. The attacker connects through a VPN using an IP address near the target’s usual location, requests a password reset for the account, and chooses to work through Meta’s AI support assistant. The attacker then instructs the bot to link the account to a new email address. The bot complies and sends a one-time code to that address, allowing a password reset and full account takeover.
The video’s authors claimed the exploit had been used to hijack a number of valuable short Instagram account names with a combined resale value of more than half a million dollars. The Verge reported that the technique may have been used to compromise more than 20,000 Instagram accounts. TechCrunch confirmed the pattern: hackers hijacked accounts by tricking the AI support chatbot into granting access, a method that fits no traditional category of social engineering.
The attack took root in a weakness that Meta created for itself. Instagram has long been known for sparse human support, and recovering a locked or hacked account can take weeks of back-and-forth with automated ticketing systems, a frustration that has driven many users to give up on recovery entirely. Meta’s solution was to deploy a conversational AI layer to handle common recovery workflows: relinking a lost email address, triggering a password reset, verifying account ownership. The assistant was supposed to reduce friction for legitimate users. Instead, it became the most available attack surface on the platform.
The hack rose to the top of Hacker News with nearly 2,000 upvotes, an unusual level of attention for a platform-security incident. The discussion was not about the specific victims. It was about what the episode says about the rush to put AI in front of sensitive operations. A chatbot that will happily add an email address to someone else’s account, on request, is a chatbot that has been given the keys to the front door.
Meta said the issue had been resolved. Andy Stone, a Meta spokesperson, said on X that the company had addressed the problem and was securing affected accounts. The security blog thecybersecguru.com reported that Meta pushed an emergency patch over the weekend and clarified that no backend database had been breached. Meta did not respond to requests for further comment.
Security researchers say the incident is a preview of a broader problem. Ian Goldin, a threat researcher at Lumen’s Black Lotus Labs, said the industry is entering uncharted territory as more large platforms allow AI chatbots to handle sensitive account recovery requests. Just as human support employees can be social-engineered into granting unauthorized access, he said, AI bots are equally eager to help and vulnerable to persuasion and trickery. “AI chatbots create an interesting new attack surface, and we’re likely,” he said, leaving the sentence unfinished.
The economics explain why the trick works. For attackers, an AI support bot is available around the clock, responds instantly, and holds no institutional memory of who has asked it for what. A human agent might notice the same email address surfacing across many accounts; a stateless model does not. The attacker can iterate, retry and refine the conversation until the bot complies. Every failed attempt costs nothing.
The episode also lands at a delicate moment for Meta’s AI ambitions. The company has been pushing its AI assistant across WhatsApp, Messenger and Instagram, positioning it as a daily utility. An assistant that can be talked into handing over accounts undermines the trust that utility depends on. Meta’s response, an emergency patch and a statement of resolution, was quick, but the underlying question remains: whether any conversational agent should be able to change account credentials on its own.
The broader lesson for the industry is uncomfortable. Platforms are racing to automate customer support because humans are expensive and slow, and AI agents are cheap and fast. The Meta incident shows the cost of that trade. The same conversational fluency that makes a support bot pleasant to talk to makes it persuadable, and the same 24/7 availability that delights legitimate users gives attackers unlimited attempts. Until platforms build verification systems that an AI agent cannot be talked out of, the support bot will keep looking like a way in.
